Salt Minion for Windows

Salt Minion for Windows is the official Windows agent of Salt (the Salt Project, formerly SaltStack), built for admins who already run a Salt master on Linux and want their Windows servers and desktops managed from the same place. If you came here looking for a “salt minion windows download” or a separate “SaltStack Windows port”, this is it: there is no independent port, only the minion installer that the Salt Project publishes alongside every release.

The minion runs as a Windows service, connects out to your master, and executes remote commands and states: installing software, managing services, registry values, files, users and Windows Update. The master itself does not run on Windows, so plan for at least one Linux or Unix box before rolling anything out.

Salt Minion for Windows at a glance

What it does

• Runs ad-hoc commands on one or thousands of Windows hosts at once, including PowerShell via cmd.run with shell=powershell.
• Applies declarative states: services, files, registry keys and values, local users and groups, scheduled tasks and features.
• Installs and upgrades software through the Windows package repository (winrepo), which maps package names to installers and silent switches.
• Lists and installs Windows updates with the win_wua execution module.
• Reports inventory through grains (OS version, domain, CPU, memory) that you can target on, for example -G 'os:Windows'.
• Reacts to events through the master’s event bus, so a minion event can trigger orchestration on other hosts.
• Ships as a self-contained “onedir” build with its own Python, so you do not install Python on the server yourself.

How sysadmins use it

Roll the minion out silently

1. Pick a branch. For production, stay on an LTS line (3008 or 3006) and keep minions at the same version as the master or older.
2. Push the installer with your existing tool (GPO, SCCM/Intune, PDQ or a script) and pass the master address and minion ID:

   Salt-Minion-3008.3-Py3-AMD64-Setup.exe /S /master=salt01.corp.local /minion-name=%COMPUTERNAME%
   
   msiexec /i Salt-Minion-3008.3-Py3-AMD64.msi /quiet /norestart MASTER=salt01.corp.local MINION_ID=fs01

3. On the master, list and accept the new keys:

   salt-key -L
   salt-key -a fs01

4. Check connectivity: salt 'fs01' test.ping.

Enforce a small baseline with a state

1. Create a state file on the master, for example /srv/salt/win/baseline.sls:

   w32time:
     service.running:
       - enable: True
   
   disable_smb1_server:
     reg.present:
       - name: HKLMSYSTEMCurrentControlSetServicesLanmanServerParameters
       - vname: SMB1
       - vdata: 0
       - vtype: REG_DWORD

2. Dry-run it first: salt -G 'os:Windows' state.apply win.baseline test=True.
3. Apply for real by dropping test=True, then add it to your top.sls so new servers pick it up.

Install software and check patches

1. Pull the community package definitions and refresh the minions’ package database:

   salt-run winrepo.update_git_winrepo
   salt -G 'os:Windows' pkg.refresh_db

2. Install a package defined in winrepo: salt 'ws-*' pkg.install 7zip.
3. See pending Windows updates: salt 'fs01' win_wua.list.

Troubleshoot on the box itself

1. Restart the service from PowerShell: Restart-Service salt-minion.
2. Run a local call to see what the minion sees: & "C:Program FilesSalt ProjectSaltsalt-call.exe" grains.items.
3. Read the minion log under C:ProgramDataSalt ProjectSaltvarlogsalt.

Install and first run

Windows (minion). Two installer types exist: the Nullsoft EXE (recommended by the Salt docs and the only one offered as onedir) and an MSI for software-distribution systems that prefer it. Install as an administrator. Since Salt 3004 the binaries live in C:Program FilesSalt ProjectSalt and configuration in C:ProgramDataSalt ProjectSalt; the main config file is confminion. Very old installs used C:salt, and the EXE has a /move-config switch for migrating them.

Master. Install it on a supported Linux distribution from the Salt Project packages. Windows cannot host the master.

Network. The minion opens outbound TCP connections to the master on ports 4505 and 4506. Nothing needs to be opened inbound on the Windows host, but the master must accept those ports from all minion subnets.

Gotchas. The default minion ID is the hostname, so cloned VMs can collide; set /minion-name explicitly. A key that is not accepted on the master looks like a dead minion. Antivirus and application control policies need to allow the Salt service and its bundled Python. Run states with test=True before touching production registry keys.

Limitations

• No master on Windows; you need Linux or Unix infrastructure.
• Windows module coverage is good but narrower than on Linux, and some modules behave differently between Windows Server versions.
• Winrepo package definitions need maintenance; a vendor changing an installer URL or switch breaks installs until the definition is updated.
• Salt is powerful and has had serious security advisories in the past; keep master and minions patched and never expose the master ports to the internet.
• The learning curve (grains, pillar, targeting, Jinja in states) is real for Windows-only teams.

Salt Minion for Windows vs alternatives

Ansible manages Windows agentlessly over WinRM or SSH, which is simpler to start but slower at scale and has no persistent event bus. Rudder focuses on continuous configuration compliance, with a web interface and reporting built in rather than added on. StackStorm is an event-driven automation layer rather than configuration management, and is often paired with a tool like Salt instead of replacing it. Choose Salt when you want fast remote execution plus desired-state management across both Linux and Windows from one master.

FAQ

Where do I get the Salt minion for Windows download?

The installers are published by the Salt Project with each release; the official install guide on saltproject.io lists the current EXE and MSI builds for AMD64 and x86.

Is Salt free for Windows?

Yes. Salt, including the Windows minion, is free and open source under the Apache-2.0 licence.

Can the Salt master run on Windows?

No. Windows is supported only as a minion; the master needs Linux or another Unix-like system.

Where is the salt minion configuration file on Windows?

In current versions it is C:ProgramDataSalt ProjectSaltconfminion. Restart the salt-minion service after editing it.

How do I restart or uninstall the salt minion on Windows?

Restart it with Restart-Service salt-minion in an elevated PowerShell. Uninstall it from Settings > Apps (or Programs and Features), or with msiexec /x if you deployed the MSI.

Which Salt version should I install?

For production use an LTS branch: 3008 LTS (currently 3008.3) or 3006 LTS. Keep minions no newer than the master.

SaltStack vs Ansible for Windows?

Ansible needs no agent but relies on WinRM and is slower across many hosts; Salt needs the minion but gives fast parallel execution and an event bus.

Last checked against official sources: 1 October 2026 (developer website: saltproject.io). Versions and licence terms change — confirm on the developer's site before deploying in production.